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APOLLO EXPERIENCE REPORT 

COMMAND AND SERVICE MODULE 

CONTROLS AND DISPLAYS SUBSYSTEM 

By Aaron B. Olsen and Robert J. Swint 
Lyndon B. Johnson Space Center 

SUMMARY 


The command and service module controls and displays subsystem provided the 
interface between the crew and the spacecraft. This interface allowed the crew to man- 
ually operate the spacecraft under normal or contingency conditions, to safely shut 
down all equipment, to monitor subsystem conditions and energy resources, to recog- 
nize malfunctions and imminent hazardous conditions, and to adjust or select alternate 
subsystem operating modes. The equipment required to accomplish these functions is 
discussed in this report. 


INTRODUCTION 


The command and service module (CSM) controls and displays subsystem (CDS) 
was composed of various electrical controls and electrically powered displays. The 
control types were on/off (switch) and variable (potentiometer and rheostat). Display 
types included the electrical meter and the flag, or lighted, indicator that displayed 
the information in an EVENT, an ANALOG, or a DIGITAL format. Excluding the inte- 
rior floodlighting, the exterior lights, and the caution detection unit (CDU), all controls 
and displays (C&D) were mounted on panels inside the spacecraft. This ~^port discuss- 
es the equipment that comprised the subsystem and presents the major problems that 
occurred during the Apollo Program. 

As an aid to the reader, where necessary the original units of measure have been 
converted to the equivalent value in the Systeme International d ’Unites (SI). The SI 
units are written first, and the original units are written parenthetically thereafter. 


DEVELOPMENT 


When the requirements for the CSM CDS had been finalized and the desired meth- 
ods of control and display had been decided, specifications were formulated for distri- 
bution to industry to obtain the hardware to fulfill the requirements. To qualify, each 



component had to undergo the following tests; design feasibility (breadboard model), 
design verification (engineering model), qualification (flight item), acceptance (flight 
item), and preinstallation (flight item). The qualification test levels varied, depending 
on the physical location of the component in the vehicle. Several items underwent ad- 
ditional qualification testing as late as 1968-1969 because the initial test levels were 
found to be inadequate. 

The basic C&D operational requirements for block n vehicles were very similar 
to those for block I vehicles. The block II vehicle was a redesigned block I vehicle with 
changes affecting spacecraft wiring, wiring harnesses, and internal structure. The 
additional C&D functions needed to accommodate the block n mission requirements 
mainly affected the lighting and the panels. Block I interior lighting consisted entirely 
of floodlights, whereas the block II spacecraft included integral lighting, backlighted 
panel components, and electroluminescent (EL) lighting for panel nomenclature and 
digital displays. Block I main display consoles (panels) consisted of several assorted 
small panels that were consolidated into three large display panels in the block II space- 
craft (fig. 1). 


COMPONENT HISTORY 


The component, the quantity used per vehicle, the part number, and the certifi- 
cation test report number of the components used in the block II C&D subsystem are 
listed in table I. Most of the items are identical to their block I counterparts; e. g. , 
the digital event timer (DET) is the same as the block I unit except for the addition of 
EL lighting to the indicator window. Some items, such as the mission timers, toggle 
switches, and EL panels, were completely new on block II spacecraft. 


Lighting 

The CSM lighting system (figs. 2 to 5) provided general interior lighting, panel 
instrumentation and nomenclature illumination, tunnel lights, exterior orientation 
lights, illumination for docking and extravehicular activity (EVA), and a flashing beacon 
for visual recognition at distances as great as 297 kilometers (160 nautical miles). The 
general interior lighting was provided by six fluorescent floodlights, each containing 
two separately controlled lamps (one primary and one secondary). The floodlight fix- 
tures were mounted on the head position at each side of the center couch, on the bulk- 
head at the head position of each side couch, and on the couch struts at the foot position 
of the center couch to light the lower equipment bay (LEB). The control for each flood- 
light consisted of an on/off switch, a primary/secondary selection switch, and a rheo- 
stat for varying the lamp input voltage. The lamps operated on direct current (dc) 
voltage that was converted to alternating current (ac) voltage by a converter inside the 
lamp fixture. Because of the numerous failures and failure modes Involved, the flood- 
light circuit design was progressively changed. 
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TABLE I. - BLOCK II CDS 


Component 

Quantity 

per 

vehicle 

Part no. 

Certification test report 

Accelerometer indicator 

1 

ME 106-0023 

26456001 

EL panel 

23 

ME 181-OXXX 

26456002, 027 

CDU 

1 

ME 430-0006 

26456003, 01226301 

Electrical indicating meter 

31 

ME 430-0170 

26456004, 01226312, 315 

Event indicator 

51 

ME 432-0172 

26456005 

Barometric- pressure 

1 

ME 432-0173 

26456006 

indicator 




Caution and warning sub- 

2 

ME 434-0020 

01226319 

system event annunciator 




Abort annunciator 

1 

ME 434-0021 

01226318 

Saturn V launch vehicle 

1 

ME 434-0043 

01226317 

engine annunciator 




External light 

10 

ME 434-0041 

26456008, 022 

Interior floodlight 

6 

ME 434-0045 

26456019, 01226316 

Miniature and dual tunnel 

6 

ME 434-0051 

26456009, 01226319 

lights 




Potentiometer 

21 

ME 444-0033 

01226310 

Rheostat 

3 

ME 444-0049 

01226311 

V ariable power transformer 

3 

ME 446-0034 

26456011 

Variable transformer- 

2 

ME 446-0036 

26456012, 021, 026 

rheostat 




Pushbutton switch 

2 

ME 452-0060 

01126303, 01226303, 313 

Pushbutton switch 

1 

ME 452-0061 

01126303, 01226303, 313 

EL pushbutton switch 

10 

ME 452-0092 

26456013 






TABLE I. - Concluded 


Component 

Quantity 

per 

vehicle 

Part no. 

Certification test report 

Rotary switch 

15 

ME 452-0093 

01126302, 309, 26456014 

Toggle switch 

340 

ME 452-0102 

26456020 

Digital event timer 

2 

ME 456-0044 

01226306, 26456015 

Electrical converter 

1 

ME 476-0049 

26456018 

Light- flashing beacon 

1 

ME 434-0055 

26456023 

Filter- flashing beacon 

1 

ME 447-0043 

26456024 

Docking light 

1 

ME 434-0054 

26456025 

1 

Mission timer 

2 

LSC-355-31600-9 
or LSC-355- 
31600-11 

Government-furnished 

equipment 

Panel assemblies 1 to 10 j 
15, 16, 100, 101, 225, 

226, 229, 306, 181, 162, 

163, 164, 230, 604, 201, 

227, 250, 275, 276, 277, 

and 278 

31 

V36 



Triggers. - Most floodlight failures were attributed to the overloading of a semi- 
conductor diode. Because of excessive current, the unit overheated the encapsulated 
circuitry and caused emission of smoke and noxious odors. The failure was traced to 
the thermal sensitivity of the three- layered semiconductor diode used as a trigger. The 
supplier confirmed that the three- layered diode could not be manufactured with adequate 
parameter controls. 

The three- layered diode trigger was replaced with a four- layered one that could 
be manufactured with adequate controls. The new trigger maintained the required 
switching speed over the required environmental range of vibration, temperature, pres- 
sure, and humidity. An improved parts screening procedure was implemented on the 
new triggers. A summary of the screening tests includes the following. 

1. A functional test of the trigger at its highest power setting 

2. A burn-in for 100 hours at 373 K (100° C) with 30 milliamperes of current 


8 









3, A thermal stress of the unit by varying the temperature from 218 to 398 K 
(-55“ to 125“ C) for 4 hours 

4. A repeated fimctional test of the trigger 

Transient susceptibility. - In July and August 1966, floodlight failures were attrib- 
uted to transient susceptibility of the lamp circuitry, which created conditions that al- 
lowed the lamp assembly to draw excessive current that, in turn, opened the fuse. The 
circuitry was redesigned to limit the current flow by the addition of an input filter, a 
time- delay network, and a zener diode. 



® Resistors on S/C 102, 106, and subsequent 


ANN annunciator 
ATT attitude 
C&W caution and warning 
DSKY display and keyboard 
EMS entry monitor system 
EV event 

FDA I flight director attitude indicator 


G&N guidance and navigation 
GPI gimbal position indicator 
LHEB left-hand equipment bay 
MOC main display console 
MSN mission 
NEUT neutral 
Nomen nomenclature 


NUM numerics 
PB pushbutton 

PUGS propellant utilization and gaging system 

RHEB right-hand equipment bay 

S/C spacecraft 

SPS service propulsion system 

SW switch 

TBI talkback indicator 


Figure 2. - Panel lighting schematic (integral and numerics). 
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Figure 3.- The command module integral Figure 4.- Tunnel lighting schematic, 
and numerics illumination system. 


Lamp tube. - Other than problems 
caused by poor handling, the greatest 
cause of tube failure was an inadequate 
amount of mercury injected into the 
tube. Manufacturing procedures were 
changed to prevent recurrence of this dis- 
crepancy. 

Lamp moisture absorption. - To pre- 
vent failures caused by moisture absorp- 
tion, improved procedures were implemen- 
ted for the application of the potting sealant 
to tube ends and epoxy surfaces. 

Silicon- controlled rectifier . - Although 
no failure was directly attributed to the fail- 
ure of a silicon- controlled rectifier, the 
following additional screening was imple- 
mented to preclude this possibility. 

1. A burn-in for 100 hours at 1 
ampere at 373 K(100° C) 



Rendezvous beacon brightness / 

Seen by eye at 111 km (60 n. mi.) or by ^ Postlanding beacon 
telescope at 297 km Q60 n. mi.); 1 flash/sec (1 flash/sec) 


Figure 5. - The CSM docking, extrave- 
hicular activity, and external lights. 


2. A test for the minimum gate turn- 
on current 


10 


Circuit protection , - The power distribution circuit was examined to determine 
the feasibility of improving the overcurrent protection by reducing circuit breaker rat- 
ings. It was determined that the existing breakers were sized to protect the power dis- 
tribution wiring and that the reduction of these ratings to provide protection for each 
light assembly would result in the loss of other lights or system elements on that same 
circuit breaker. The final corrective action adopted was to add a fuse in each power 
input circuit of each light assembly. 

Transient protection. - To protect against the effects of switch contact bounce, 
the input filter chokes were replaced with 0. 25- ohm resistors, and the 6. 8- microfarad 
input filter capacitance was increased to 68 microfarads. Also, a 102-millisecond 
time- constant delay network and a zener diode were added to limit the maximum voltage 
that could be applied to the trigger circuit. 

Lens strength. - During spacecraft checkout, the plastic lenses of the floodlights 
were found to be susceptible to breakage and dislodgment with normal checkout handling. 
This susceptibility disclosed the possibility that mercury could be released in toxic 
amounts into the command module (CM) interior if fluorescent lamps inside the flood- 
light should become cracked or broken. An investigation revealed that this suscepti- 
bility was caused by inadequate strength of the lenses and lens attachment to the flood- 
light cases. Lenses and lens- case attachments were redesigned. Thicker, more rug- 
ged lenses of high- impact plastic were used. Lenses were produced by machining and 
optical polishing. The previously used adhesive- bonding technique for lens attachment 
to the case was replaced by a mechanical fastening. These changes provided greater 
lens- case strength and, consequently, improved lamp protection. The redesigned lens- 
es met the following requirements; stress of 890 newtons (200 pounds) applied on 6. 45 
square centimeters (1 square inch) of the lens surface; stress of 1334 newtons (300 
pounds) applied on 25. 8 square centimeters (4 square inches) of the lens surface; and 
impact by a 7-kilogram (15 pound) disk (38 centimeters (15 inches) in diameter by 1. 3 
centimeters (0. 5 inch) thick) moving at 0. 6 m/sec (2 ft/sec). 

To make the CM interior more fireproof, the high- impact plastic lens was re- 
placed by a lens of laminated glass. Because the glass lens could splinter on hard im- 
pact, it was overlaid with a thin (approximately 0. 008 centimeter (0. 003 inch)) coating 
of fluorinated ethylene propylene Teflon to prevent injury to any crewmember should 
splintering occur. 

Fluorescent tube protection. - To prevent leakage of mercury vapor in case of 
fluorescent tube failure (crack or break), a protective coating of Teflon was added to 
the tube, and the tube ends were encapsulated to provide a seal. 

Noise . - Rotation of the floodlight- brightness- control rheostat for the primary 
floodlights caused a high-pitched noise. The rheostat was encapsulated in a new con- 
figuration, using a hard-shelled room- temperature- vulcanizing (RTV) adhesive. 

Electroluminescent lighting. - The panel nomenclature and instrumentation digital 
readouts were illuminated by EL panels. The EL lighting operated on 11 5- volt ac, 

400- hertz power. The EL lighting was relatively trouble free throughout the program. 
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other lighting. - Lighting for the tunnel area was provided by six incandescent 
fixtures, each containing two miniature 28- volt dc lamps (fig. 4). Exterior lighting 
(fig. 5) consisted of a docking spotlight, eight orientation or identification lights (four 
amber, two red, and two green), a rendezvous flashing beacon, and a white floodlight 
for EVA’s. The docking spotlight was electrically deployed on a spring- mounted door 
and projected a light beam 21. 3 meters (70 feet) in diameter at a range of 61 meters 
(200 feet). The orientation lights were small lamps spaced around the service module 
(SM) for position identification by other vehicles. The rendezvous flashing beacon, 
located in the forward section of the SM, used a xenon tube that flashed at a rate of 
1 flash/sec for a duration of 20 milliseconds and was visible by telescope for 297 kil- 
ometers (160 nautical miles). The beacon was used for long-distance identification by 
the lunar module (LM) crew when approaching the CM. The white floodlight (EVA 
light), also located in the forward section of the SM, was spring loaded to deploy when 
the boost protective cover was jettisoned. The floodlight was used to illuminate the 
hatch area and the side of the CM during EVA. The tunnel lighting and all exterior 
lighting were relatively trouble free during the entire program. 


Caution and Warning Subsystem 

The caution and warning subsystem (C&WS) (figs. 6 and 7) monitored critical 
parameters of most of the spacecraft operational systems and alerted the crewmembers 
to malfunctions or out- of- tolerance conditions when they occurred in any of these sys- 
tems. The C&WS was composed of the CDU, system status light matrices, master 
alarm (MA) switches, and associated control switches. The CDU, the major compo- 
nent in the C&WS, was located behind panel 3. The CDU contained two redundant regu- 
lated ±12- volt dc power supplies, high- and low- limit comparators, logic circuitry, 
level detectors, lamp drivers, and a two- level- output tone generator. When a mal- 
function or out- of- tolerance condition occurred, the alarm limits (reference voltages) 
were exceeded. These alarm- limit signals triggered voltage comparators that acti- 
vated logic and lamp driver circuits. These circuits activated the MA, the tone gene- 
rator, and the appropriate system status light on panel 2. The MA light and the bilevel 
(750 to 2000 hertz) tone were reset when the MA pushbutton switch was depressed. 
However, the status lights on panel 2 remained lighted as long as the malfunction or 
out-of-tolerance condition existed. The status lights could be prevented from lighting 
when there was an out-of-tolerance condition by positioning the "normal/boost/ 
acknowledge" switch to "acknowledge. " When a malfunction occurred with the switch 
in this position, only the MA and the tone generator were energized, but the status 
light was lighted only while the MA was depressed. When the switch was placed in the 
"boost" position, the MA light adjacent to the red "abort" light on panel 1 was disabled 
to prevent possible confusion between the two lights. Thirty-three of the available 48 
matrix status lights on panel 2 were used as system inputs; some of the lights had as 
many as 7 separate inputs to indicate malfunctions. If there was more than one param- 
eter to a status light, the first malfunction to occur triggered the tone, the MA light, 
and the status light. As long as the malfunction existed, the tone and MA circuits could 
not be reset for that particular channel, and any of the other parameters in the channel 
that went out of tolerance were unable to indicate the out- of- tolerance situation through 
the C&WS. This condition, known as masking, was very undesirable. However, by the 
time this condition was recognized as a problem, correction would have required a ma- 
jor redesign and redevelopment program on the CM C&WS. The main reason for not 
correcting the masking problem was that all parameters in question could be monitored 
elsewhere during this period. 
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Figure 6. - Schematic of C&WS power distribution. 
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Figure 7. - The C&WS MA schematic. 


No known vehicle test failures and only one reported flight anomaly occurred in 
the C&WS. The reported anomaly occurred approximately 0. 45 second after final ring- 
latch closure during the initial transposition and docking maneuver of the Apollo 9 
(CSM 104) mission. Analog and bilevel data did not indicate any out- of- tolerance con- 
dition at the time. The fact that the alarm occurred during the hard docking rather than 
at physical contact ruled out static discharge between the two vehicles and indicated a 
shock- sensitive condition. The C&WS MA circuit was a latching system that could re- 
spond to transients of 10 microseconds in duration, and a transient on any of the 69 in- 
puts could trigger the alarm. Analysis of CSM 104 flight data revealed no system 
anomaly; thus, the specific cause remains unknown. 

Most of the C&D components mounted in the panels had a relatively low or insig- 
nificant failure record; however, some had numerous failures and a few underwent a re- 
design and requalification phase. The following discussion describes the C&D compo- 
nents, emphasizing the ones with the most recorded failures. 


I 
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Mission Timer 


The electronic mission timer indicated time in hours, minutes, and seconds on 
a seven-digit EL panel. Maximum accumulative time was 999 hours 59 minutes 59 sec- 
onds. The timer operated on 28- volt dc and 115- volt ac, 400-hertz power, and it used 
the 10-pulse/sec signal from the central timing equipment (CTE) or its own internal 
tuning fork as a time reference. 

The internal tuning fork time reference was effective when the CTE became inop- 
erative. This time was indicated by a small lighted tuning fork symbol to the left of the 
seven-digit panel. Stop, start, reset, and slew controls were adjacent to each of the 
two mission timers in the CM (one each on panels 2 and 306). The mission timer was 
supplied to the CSM contractor as Government- furnished equipment and was identical 
to the one used on the LM. The initial recorded failure on a CM was in February 1967 
on CSM 101. Between February 1967 and November 1969, there were 12 failures, 3 of 
which occurred during flight. An investigation revealed that the failures were traceable 
to cracked solder joints, which were caused by internal differential thermal expansion 
between the end terminal boards of the cordwood construction and the encapsulating ma- 
terial used to protect the internal electronic components against shock and vibration. 
Unsuccessful attempts were made to open the hermetically sealed units, to resolder the 
terminals, to reseal the units, and to reuse them. Finally, in 1969, the decision was 
made to redesign the units, using integrated circuits and welded connections instead of 
the cordwood construction and soldering, which had been dictated by the use of discrete 
components. 

Several problems were encountered with the redesigned timer. The EL digital 
panels, reused from earlier timers made by a previous vendor, were not as bright as 
desired. However, the lack of light intensity was not as great a problem as a defect 
in the original EL panels made by the new vendor; these panels would not withstand the 
voltage (11 5- volt ac, 400 hertz). Thus, a second new vendor for the EL panels had to 
be found. The later EL units were relatively trouble free. 

While testing the timer, it was found that the combination of electrical parameters 
at several temperature values reduced the gain to a point where the new oscillator would 
not restart every time it was stopped. Circuit analysis indicated that the problem was 
in the integrated- circuit logic gates. Substitution of transistors for the logic gates 
solved the problem. 

Several procurement problems were experienced with printed circuit boards and 
integrated circuits, but these problems were solved by locating new supply sources. 

The insulation resistance of the input filter inductor was a problem on the earlier re- 
designed timers, but a better filter inductor was found after several months of search- 
ing. The new mission timer experienced three failures, one light input filter capacitor 
on CSM 112 (Apollo 15) and an EL segment on each of the timers on CSM 114 (Apollo 17). 
To correct these problems, the timer ac input circuits were fused, and the capacitor 
rated voltage was increased. 

Delivery delays were caused by additional paperwork required because one initial 
prime contractor did not have direct access to the vendor but instead had to deal direct- 
ly with a second prime contractor. 
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Digital Event Timer 

The DET was an electromechanical 
device that counted up or down in minutes 
and seconds to a maximum of 59 minutes 
59 seconds. There were two DET’s on 
each CM; one on panel 1 for flight control 
and one on panel 306 for navigational pur- 
poses. The DET would reset to zero and 
begin counting up when a lift-off or an 
abort signal occurred. Timer controls to 
stop, start, count up and down, and slew 
each digit were on the same panel with the 
timer. Of the 22 failures that occurred, 5 
were electrical, and the remaining 17 were 
caused by mechanical problems in the 
counting- wheel mechanism. Only four of 
these failures occurred during flight (one 
each on CSM 106 and CSM 113 and two on 
CSM 112). Although the electrical prob- 
lems were varied (EL lighting, timer fail- 
ing to stop on "reset, " and broken wire), 
they were not difficult to correct. 

The mechanical problems consisted 
of interference between the gear and the 
counter wheels and contamination of the 
brushes and the sliprings. These problems 
were first attributed to the looseness of the 
dimensional tolerances, which allowed the 
idler gear (figs. 8 and 9) to rub against the 
number wheel and dislodge paint particles 
from it. Being nonconductive, the paint 
particles would adhere to the slipring and 
prevent the brush from making contact, 
which, in turn, would prevent the counting 
pulse from being transmitted to the next 
counter wheel. When brass shims, insert- 
ed between the idler gear and the spacers 
on the shaft to provide more clearance, did 
not correct the problem, a more thorough 

investigation was made. During this investigation, it was found that the stainless- 
steel shaft on which the idler gear turned was not fastened securely to the magnesium 
motor plates. This slack allowed the shaft to turn, and the small moment applied to 
the end of the shaft by the idler gear eroded the shaft hole to an oval shape. The end- 
plate erosion was sufficient to allow the shaft to move and to cause the idler gear to rub 
the paint off the number wheel. Because the timer was not mission critical and because 
only one flight remained in which the timer would be used very often, the decision was 
made to visually inspect the timers before flight rather than to attempt a redesign and 
refurbishment program. 



Norma! 


-0. 381 cm 
(0.150 in.) 
-0.102 cm 
(0. 040 in.) 


Abnormal 


Figure 9. - Idler gear. 
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Electrical Indicating N\eters 

The panel meters were of the D'Arsonval or moving- coll type and varied in scale 
types from single to dual and from circular to elongated. No in-flight panel-meter 
failures occurred. Most failures occurred during vendor acceptance checkout and were 
caused by out- of- tolerance pressure leakage, by inadequate or excessive play in jewel- 
pivot end joints, by inaccurate calibrations, or by foreign particles interfering with 
coil rotation. The high leakage rate was corrected by adding a secondary seal of epoxy 
cement overlaying the solder seals. The inadequate or excessive play in the jewel- 
pivot end joints, the inaccurate calibrations, and the interior contamination problems 
were corrected by readjustment, recalibration, and an internal cleaning process in the 
vendor’s facility before retest and shipment. 


Event Indicators 

The event indicator is an electromagnetic device that drives a drum or shutter- 
type display. The manner of display depends on the type of sensor driving it. In a 
valve position, if the valve- actuating device gives a proportional signal to the indicator, 
the varying position of the valve is shown by the indicator. No known flight failures of 
the event indicator occurred. Failures in the vendor acceptance and vehicle test pro- 
grams were primarily caused by mishandling or by poor workmanship. These failures 
consisted of foreign particles, out- of- adjustment or out- of- socket jewel and pivot, and 
excessive flag excursion. The excessive flag excursion was caused by improper jewel 
and pivot adjustment and was the result of poor workmanship. To correct these prob- 
lems, the vendor reworked and reevaluated each unit before delivery. 


Potentiometer 

The potentiometer, a hermetically sealed unit with a carbon element and a brush, 
was used in the CM for volume and squelch control in the communication system and 
for cabin heat control in the environmental control system. The shaft was connected 
to the internal element through a sealed bellows assembly. The potentiometer was 
mounted behind the panel so that the shaft was parallel to the panel surface and the 
thumbwheel control protruded through the panel surface. Because of the side loading 
on the shaft, the brush elements were overriding the stop and breaking inside the her- 
metically sealed unit. This problem was solved by installing a bearing support for the 
outer end of the shaft with an external mechanical stop. Some problems with shaft 
binding in the bearing surface still remained; however, these problems were solved 
with better alinement and some dry lubricant. No known flight failures occurred, and 
almost all the reported failures in the vendor acceptance, the panel checkout, and the 
spacecraft test phases were attributable to side loads on the shaft and overriding of the 
internal stop as a result of excessive loads. 


Rotary Switches 

Rotary switches were used as selector switches when there were more than two 
required selections. The switches used on the CM varied in capacity from 2 to 10 poles, 
from 2 to 12 positions, and from 1 to 5 decks. The switches had a very successful 
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history with few vehicle test failures and only one reported flight anomaly. This anom- 
aly occurred on the Apollo 15 (CSM 112) mission when the battery relay bus voltage on 
the system/test meter (panel 101) indicated approximately 14 volts instead of 32 volts. 
Panel 101 contained two rotary switches. Postflight tests conducted in the CM at the 
contractor's plant and at the vendor’s facility revealed no conditions that supported the 
reported flight anomaly. 

The ’’extra” detent indication was a development problem first noticed on space- 
craft 008 and 012 (both block I vehicles). The irregularity had been previously noticed 
but no corrective action was taken until a short circuit occurred between contacts. 

When the short circuit occurred, the switch was in the extra or ’’false” detent position 
because assurance had been given that no current flow would occur when the switch was 
in that position. As a result, a redesign and reevaluation effort was made, and the 
switches delivered for spacecraft 012 changeout were of the redesigned configuration. 

The extra detent difficulty is explained in the following discussion. 

The span between positions was 30° (fig. 10). During the first 15° of rotation, 
the spring-loaded star ball was climbing the ramp of the star wheel, and the spring- 
loaded contact ball was going down the ramp of the contact button. During the last 15° 
of rotation, the spring-loaded star ball was going down the ramp of the star wheel, 
generating enough force to permit the spring-loaded contact ball to climb the ramp of 
the contact button. Extra detent was felt at the 15° point because the spring-loaded con- 
tact ball was starting to climb the contact button ramp and the spring-loaded star ball 
was not yet going down the ramp of the star wheel. Because the star ball was at the 
point of the star, no force was being generated for climbing the ramp of the contact 
button. This effect was more noticeable on multiple-pole, multiple-deck switches 
where there were many contact button ramps to climb. Because of the tolerance build- 
up at this midway position, the number of contacts made could not be readily determined. 




Figure 10. - Rotary switch. 
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To remedy the extra detent problem , the vendor lowered the ramp angle on the 
contact buttons and improved tolerances by changing the tooling jigs. The spacecraft 
012 deliveries were the first to have these modifications. 


Pushbutton Switches 

Pushbutton switches were used as backup controls for the initiation of events that 
would normally occur as automatic functions and as the C&WS MA reset. No flight fail- 
ures were recorded, but several failures occurred during vehicle testing. One of these 
failures, which forced the removal of approximately 57 switches from vehicles pro- 
duced after CSM 107, resulted from the vendor’s use of a paraffin- type material in a 
grinding operation to avoid the entry of ground- off particles around the actuation but- 
tons on the contact portions of the switch. The material hardened and prevented switch 
actuation. Another vehicle failure resulted from a switch missing one of the manufac- 
turing process steps, which was to have crimped the pushbutton plunger base over the 
insulation board of the EL lamp lead. The problem occurred in the environmentally 
sealed portion of the switch. When the external ambient-pressure was reduced in the 
altitude chamber, the plunger, which had been held in by the strength of the EL lead 
wires as long as the pressures remained equal, pushed the face of the switch out so 
that it was protruding from the surface of panel 1 (fig. 11). 


Toggle Switches 

Toggle switches, used as manual con- 
trol elements on the CM, were configured 
in one to four poles and in two or three po- 
sitions and were of a maintained, momen- 
tary, or lock type, depending on the use. 

The block I toggle switch was an environ- 
mentally sealed unit with a low failure rate. 

After the block II requirements were estab- 
lished for a hermetically sealed switch, it 
was determined that the block I vendor did 
not manufacture one and did not choose to 
manufacture one. Consequently, the ini- 
tial block II toggle switch was a hermeti- 
cally sealed plunger- type unit with an un- 
sealed toggle mechanism for switch actua- 
tion. Early in the block II program, switch 
problems became apparent. Failures 
caused by high contact resistance, by me- 
chanical lockup, and by nonfunction at high 
or low pressure resulted in a change to the 

present completely hermetically sealed switch. This switch had many serious prob- 
lems (figs. 12 to 14), such as internal solder balls, extra parts and pieces inside 
switches, contact buttons welded to a terminal post in an inverted position, defective 
contact- button welds, auxiliary contact- plate welds, momentary shorting of contact 
arm with spring, cracked toggle block assembly and bellows, annealing and displacement 



Figure 11.- Pushbutton switch plunger 
cutaway. 
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Figure 12.- Toggle-switch problem. 
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Figure 13.- Momentary switches. 


Figure 14.- Toggle switch. 


of the momentary return spring, spring shorting to contact arm during sinusoidal vibra- 
tion, and high contact resistance. 

Most of these problems were corrected by the addition of inspection stations dur- 
ing manufacturing, by better workmanship, by altering some of the weld processes, 
and by adding several additional steps to the acceptance test procedure (ATP). One of 
the most valuable additions was the requirement for multiaxis X-ray exposures. De- 
spite the poor performance during ATP and vehicle test, only one flight failure was 
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recorded. On the Apollo 15 (CSM 112) mission, the differential-velocity thrust switch 
provided a groundpath through a small strand of wire from the switch internal braid 
and lighted the entry-monitor thrust lamp. The fault could have been serious had it 
been on the engine-valve power input of the service propulsion system solenoids. 


Other Components 

The variable transformer, variable transformer- rheostat, rheostat, accelerom- 
eter, barometric- pressure indicator, and engine annunciator each had a low failure 
rate during vehicle testing and had no flight failures. 


CONCLUDING REMARKS AND RECOMMENDATIONS 


The mission requirements for the command and service module controls and 
displays subsystem were satisfied very well during the Apollo Program. Failures 
were numerous and costly, but a very thorough qualification and test program pre- 
vented any catastrophic incidents. The failures were costly because the time required 
for component removal and replacement in the panel was long and the retest was ex- 
tensive. 

The following recommendations should be considered for future spacecraft. 

1. Display panels containing control elements should be simple to remove as a 
unit or, whenever possible, the individual control elements should be modular plug-ins. 

2. When there is a choice between the electrical or mechanical accomplishment of 
a function, the electrical method has been shown to be superior in this subsystem. 

3. When the same component is used by more than one prime contractor or on 
more than one vehicle, the component should be procured from a single vendor using 
identical specifications, if at all possible. 

4. Gtovernment-furnished equipment should be delivered directly to the user from 
the Government installation or from the vendor rather than from one prime contractor 
to another. 

5. Crewmembers have on several occasions expressed a desire for switches 
that are lighted in some manner to indicate location and status during darkened opera- 
tions and sleep periods. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, July 2, 1976 
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